标签：#cyber

A hacker pretending to work for a leading cryptocurrency news website targeted several cybersecurity professionals using Google Docs as a way to deliver malware.

OpenAI presented details of its AI’s model’s cyberattack on Hugging Face at Black Hat last week. Simon Willison details the timeline. It’s really interesting to read through—and really impressive cyberoffense work.

By RUGERO Tesla ( @404Saint ). IEC 60870-5-104 (IEC 104) is the TCP/IP-based member of the IEC 60870-5 telecontrol family. It was designed to carry SCADA telemetry and control information across packet-switched networks, particularly within electrical power systems. Before getting into raw packets, it is worth understanding how IEC 104 is structured, how its communication state is maintained, and where its security boundaries actually exist. This is the map before we meet the protocol on the wire. Protocol Stack IEC 104 operates over TCP, commonly using port 2404 . Two protocol components are particularly important: APCI : Application Protocol Control Information ASDU : Application Service Data Unit The APCI handles framing, sequencing, acknowledgments, and connection control. The ASDU carries the actual telecontrol information. +-------------------------------------------------------------+ | ASDU | | Type ID | VSQ | COT | CA | IOA | Information Objects | +-------------------------------------------------------------+ | APCI | | 0x68 | Length | Control 1 | Control 2 | Control 3 | Ctrl 4 | +-------------------------------------------------------------+ | TCP / IP | +-------------------------------------------------------------+ Every APDU begins with the 0x68 start byte, followed by a length field and four control bytes. The length represents the bytes following the length field, including the four control bytes and, when present, the ASDU. That fixed structure is the starting point for understanding IEC 104 traffic. I, S, and U Formats IEC 104 defines three APDU formats. I-Format: → I-format frames carry application information and therefore contain an ASDU. They also carry two sequence numbers: N(S) : send sequence number N(R) : receive sequence number These allow communicating stations to maintain ordered transmission and acknowledgment state. S-Format: → S-format frames are supervisory frames. They do not carry an ASDU. Their purpose is to communicate receive ac

The data search and AI giant confirmed unauthorized access to its systems during an incident on Tuesday, and said it was investigating the breach.

Hackers are targeting internet-connected Siemens controllers used in water facilities around the United States.

Two AI agents just fought over a Snowflake PR. You should read about it. In five days, two AI agents turned a Snowflake connector repo into a live demo of machine-vs-machine offense. On June 18, 2026, GitHub Copilot Autofix co-authored a commit that quietly dropped input sanitization from a shell-based run block. On June 23, an autonomous AI security agent — running an offensive scan — found the flaw, broke out of an echo string by crafting an issue title, and exfiltrated Jira credentials from Snowflake's GitHub Actions runner. No human analyst pulled the trigger. The patch landed within hours of detection, but the credentials were exposed in the gap. This is what an AI-on-AI supply chain fire looks like in 2026. It is also the most honest argument for treating AI-generated code the way we treat any other untrusted dependency: review it, sandbox it, and stop letting it author the parts that don't change. What Copilot Autofix actually changed The commit that broke the repo did not look alarming on the diff. Copilot Autofix — the automated remediation tool GitHub ships to close technical debt — proposed a refactor of a run block in a GitHub Actions workflow. The new version replaced the repo's existing sanitized input pattern with direct string expansion inside a shell script. Same behavior on the happy path. New script injection vector on every unhappy path. That is the threat model people don't draw in their head when they're using Copilot. The tool is optimizing for "looks right, runs right". It is not optimizing for "every quoted character is escaped in the shell interpolation that this string lands in". The minutes saved during authoring became the seconds the attacker needed to find the seam. [[COMPARE: the sanitized input pattern that was removed vs the direct string expansion that replaced it]] // The pattern that was removed // Before const safe = userInput . replace ( / [ ;&|`$<> ] /g , '' ); run : echo " $value " | process " $safe " // After — direct string

Multiple cybersecurity researchers said they suddenly lost access to OpenAI’s Trusted Access for Cyber (TAC) program, which offers models with fewer guardrails for vetted users.

The U.S. phone provider escaped a large-scale breach of its network after identifying Chinese-backed hackers early on.

The cyberattack at CareCloud resulted in one of the largest reported data breaches in the U.S. healthcare industry this year.

The ChatGPT maker says its upcoming Astra model may have reached “critical” cyber capabilities, prompting it to halt a significant number of training runs while it tightens internal safeguards.

A new feature added to Comcast's newest routers can detect if there is motion is inside your home without needing traditional motion sensors.

Passwords are less secure than passkeys, even if you use a password manager. Here's why and how to get started with passkeys.

This is the latest large-scale DDoS attack to hit the social networking site this year.

Developers write far more legally consequential prose than they think, and almost none of it is code. It's the SECURITY.md in the repo root. It's the "Security" page someone in marketing asked you to fill in three years ago. It's the status page update typed at 2 a.m., and the sentence in a customer notice specifying exactly which data was affected. The research summarized in this overview of what the evidence shows about cyber incident disclosure treats post-breach communication as a measurable discipline with predictable failure modes — and the enforcement record of the last three years has quietly turned it into an engineering discipline too. In the most closely watched cybersecurity case of the decade, the only allegation that survived a motion to dismiss concerned a technical description of access controls posted on a website. The claim that survived was written by engineers On July 18, 2024, Judge Paul Engelmayer of the Southern District of New York issued a 107-page opinion in the SEC's case against SolarWinds and its CISO. Most of it was a defeat for the agency. Claims built on blog posts, press releases, and podcast appearances were dismissed as non-actionable corporate puffery — statements too general for any reasonable investor to lean on. The theory that cybersecurity controls fall under "internal accounting controls" was rejected outright. Post-incident 8-K disclosures were held to be reasonable given what was knowable at the time. One thing lived: the company's "Security Statement," a technical page describing its practices to customers. The court let claims proceed specifically on its representations about access controls and password policy , because those were concrete enough to rely on and, as pled, contradicted by internal presentations, security assessments, and Slack messages. The SEC ultimately dismissed the whole action with prejudice in November 2025, so no liability was ever established — but the legal line drawn in 2024 didn't go anywhere.

Z.ai’s latest AI model release could help companies secure their systems—or find its way into the hands of hackers.

The most important AI security story right now is not that models can find bugs. It is that models can find more bugs than humans can responsibly process. That is the part that changes how builders should think about software. For years, security work was constrained by discovery. Could someone find the vulnerability? Could they reproduce it? Could they build an exploit? Could a small team afford enough expert review to catch the important issues before attackers did? Now that bottleneck is moving. Anthropic's recent Project Glasswing update is the clearest signal yet. The company says Claude Mythos Preview and its partners found more than 10,000 high- or critical-severity vulnerabilities across major software systems. In open source alone, Anthropic says it scanned more than 1,000 projects and surfaced thousands of serious findings, with human triage becoming the slow part. You do not have to take every number at face value to see the shape of the shift. AI is making vulnerability discovery cheaper. That sounds like good news, and it is. But it also means every software team is about to face a harder question: What happens when the scanner is faster than the organization? The Patch Window Is the Product Now Security used to have a familiar rhythm. A bug was found. A report was filed. A team reproduced it. Someone argued about severity. Someone wrote a patch. Users eventually upgraded. That process was never fast enough, but it mostly matched the speed of human discovery. AI breaks that balance. If models can search codebases, reason about exploit paths, generate reports, and repeat that work across thousands of projects, then finding bugs stops being the scarce skill. The scarce skill becomes the system around the finding: Can you tell which reports are real? Can you prioritize the ones that actually matter? Can you patch without breaking production? Can you ship fixes before attackers learn the same thing? Can you keep maintainers from drowning in low-quality repo

Cybersecurity experts who investigate spyware attacks say the number of people who received a recent threat notification from Apple is unusually high.

When I first got interested in cybersecurity, I thought it was all about tools. Nmap, Metasploit, Wireshark, Burp Suite. I downloaded them all, watched tutorials, and felt like a hacker. But the first time I tried to customize a scan or parse a weird log file, I hit a wall. I didn't know how to code. And in cybersecurity, that's like trying to be a chef without knowing how to use a knife. This article is for people who want to move beyond clicking buttons. Whether you're a beginner deciding where to start or a security analyst who wants to automate boring tasks, programming will change how you work. I'll cover why programming matters, what languages to learn, the concepts you'll actually use, projects to build, and how to think like both an attacker and a defender. Why programming isn't optional anymore Cybersecurity used to be more forgiving. You could run a vulnerability scanner, read the report, and call it a day. But threats have gotten more complex, and so have the defenses. Today, you need to: · Write scripts to analyze thousands of log lines in seconds. · Automate repetitive tasks like phishing email analysis or IP reputation checks. · Understand the code behind vulnerabilities so you can explain them to developers. · Build custom tools when existing ones don't fit your environment. · Test your own code for flaws before attackers find them. If you can't read or write code, you're limited to what someone else built. That's not a career; that's a hobby. Programming gives you the ability to solve problems no tool can solve out of the box. What "programming for cybersecurity" actually means It's not software engineering. You don't need to build a full web application or master design patterns. Instead, you use code as a tool for investigation, automation, and exploitation (ethically, of course). Different roles need different levels of programming: · SOC analysts might write Python scripts to correlate logs or query APIs. · Penetration testers write proof-of-conc

The hacks at shipping companies used to mail out hardware wallets puts crypto owners at greater risk of real-world attacks.

When a vendor is breached, don't wait for their update page: figure out fast what that vendor can see or touch inside your business, and act on that answer before you have all the facts. Vendor breaches are a recurring headline: a phone system, messaging platform, or file-sharing tool used by thousands of businesses discloses an incident, and every customer of that vendor suddenly has to ask what it means for them, usually with almost no visibility into the vendor's internal investigation. The gap between "something happened to our vendor" and "here's what we do about it" is where most companies lose time they can't get back. Quick answers What's the first thing to do when a vendor is breached? Confirm exactly what that vendor can access in your systems — before you do anything else. Should I rotate credentials before the vendor confirms exposure? Yes, for anything plausibly exposed — even though it may briefly disrupt a live integration. How often should I re-check a slow-to-disclose vendor? It depends on how much access they hold — high-privilege vendors need a 48–72 hour check-in, not a week. Do I need a written plan before an incident happens? Yes — a one-page plan per privileged vendor, reviewed at least yearly. Why vetting a vendor once isn't enough Most businesses do vendor due diligence at signup: a security questionnaire, maybe a look at their trust page, a checkbox before the contract is signed. That's reasonable, but it only answers the question that matters on day one: is this vendor safe to start using? It doesn't answer the question that matters every day after: if this vendor gets breached, what happens to us, and what do we do? Vetting is a point-in-time filter. A breach is an ongoing event with a timeline, and your response needs its own plan, separate from the vetting checklist you ran before signing. The fix is simple: treat vendor risk as a lifecycle, not a gate. Vet before you sign, revisit access and exposure on a regular cadence, and have a re